MCP SERVERLook up what an IP is running, what a CVE actually scores on EPSS and KEV, and which of your products carry known-exploited vulnerabilities — without leaving the conversation.
LABSCO SUMMARY
The vulnerability half is the stronger one: cve_lookup returns EPSS and KEV status next to the CVSS scores, and cves_by_product filters to known-exploited entries and sorts by EPSS, which is the ordering that decides what gets patched this week rather than next quarter. Both DNS tools take batches, so a list of hostnames costs one call instead of one per name. Every tool here reads; nothing in this list changes anything.
A server over Shodan's host data and its CVEDB, seven tools covering IP and DNS lookups, device search and vulnerability queries.
SHODAN_API_KEY for a Shodan account. The vulnerability tools query Shodan's CVEDB, so they answer for product names and CPE 2.3 identifiers rather than for a host you point at them.
One command plus a key — npm install -g @burtthecoder/mcp-shodan, then supply credentials
USE CASES
One lookup returns the open ports, the service banners, the certificates and the cloud provider; the reverse lookup adds the names attached to it, in a batch if the log gave you several addresses at once.
CVSS alone does not settle it. The lookup returns EPSS probability and KEV status next to the scores, and the product query re-ranks a whole list by exploitation likelihood rather than severity.
Resolve the product to its CPE entries first so the vulnerability query is precise rather than name-matched, then use the device search to see how the same software looks from outside.
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
cpe_lookupSearch for Common Platform Enumeration (CPE) entries by product name in Shodan's CVEDB. Supports pagination and can return either full CPE details or just the total count. Useful for identifying specific versions and configurations of software and hardware.
cve_lookupQuery detailed vulnerability information from Shodan's CVEDB. Returns comprehensive CVE details including CVSS scores (v2/v3), EPSS probability and ranking, KEV status, proposed mitigations, ransomware associations, and affected products (CPEs).
cves_by_productSearch for vulnerabilities affecting specific products or CPEs. Supports filtering by KEV status, sorting by EPSS score, date ranges, and pagination. Can search by product name or CPE 2.3 identifier. Returns detailed vulnerability information including severity scores and impact assessments.
dns_lookupResolve domain names to IP addresses using Shodan's DNS service. Supports batch resolution of multiple hostnames in a single query. Returns IP addresses mapped to their corresponding hostnames.
ip_lookupRetrieve comprehensive information about an IP address, including geolocation, open ports, running services, SSL certificates, hostnames, and cloud provider details if available. Returns service banners and HTTP server information when present.
reverse_dns_lookupPerform reverse DNS lookups to find hostnames associated with IP addresses. Supports batch lookups of multiple IP addresses in a single query. Returns all known hostnames for each IP address, with clear indication when no hostnames are found.
shodan_searchSearch Shodan's database of internet-connected devices. Returns detailed information about matching devices including services, vulnerabilities, and geographic distribution. Supports advanced search filters and returns country-based statistics.
BEFORE YOU INSTALL
7 tools when we connected. All seven are reads. Calls fail on an invalid key (401), exhausted query credits (402) or rate limiting (429), and older references to a vulnerabilities tool mean cve_lookup.
CONTEXT COST
Rated by the size of the 7 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
npm install -g @burtthecoder/mcp-shodanclaude mcp add --transport stdio --env SHODAN_API_KEY=<YOUR_SHODAN_API_KEY> shodan -- npx -y @burtthecoder/mcp-shodancodex mcp add shodan --env SHODAN_API_KEY=<YOUR_SHODAN_API_KEY> -- npx -y @burtthecoder/mcp-shodangemini mcp add -e SHODAN_API_KEY=<YOUR_SHODAN_API_KEY> shodan npx -y @burtthecoder/mcp-shodan{
"mcpServers": {
"shodan": {
"command": "mcp-shodan",
"env": {
"SHODAN_API_KEY": "<YOUR_SHODAN_API_KEY>"
}
}
}
}MCP servers
mukul975
gensecaihq
Medinios
martc03